User:JM01085758/lockdown

This article is a work in progress; treat its contents with caution - JM01085758 (talk | contribs).

Resources

manpage

Since kernel version 5.4, support has been added for integrity and confidentiality lockdown modes. Lockdown is a Linux Security Module (LSM) which expands the traditional LSM focus on control once userspace is active to having an LSM enabled very early in the boot sequence, even before kmalloc() can request memory. Integrity mode disables features that allow userspace to modify the running kernel. Confidentiality mode does the same but goes further, also preventing extraction of confidential information. Enabling either will prevent the loading of unsigned kernel modules as well as unencrypted hibernation or suspend to swap. By default in Gentoo, neither mode is enabled, but on EFI x86 or arm64 with other distributions, lockdown may be automatically enabled when Secure Boot is enabled.

Background

The motivation for implementing this feature was "to enforce a distinction between running as root and the ability to run code in kernel mode". To quote Matthew Garrett, "if you can run arbitrary code in the kernel then you can use the kernel to boot anything you want", defeating the point of UEFI Secure Boot. Work on the lockdown LSM began in the early 2010s.

Kernel

KERNEL menuconfig

Security options  ---> 
    [*] Basic module for enforcing kernel lockdown
    [*]   Enable lockdown LSM early in init
          Kernel default lockdown mode (Integrity)  --->

GRUB

Lockdown modes can also be enabled via GRUB: GRUB_CMDLINE_LINUX="lockdown=integrity".

Impact

Enabling one of the lockdown modes will affect one's ability to modify and/or read from the following:

• /dev/mem

• /dev/kmem

• /dev/kcore

• /dev/port

• Model-specific registers (MSRs)

• debugfs

A more extensive list can be seen here.

Vulnerabilities

Kernels prior to 5.19 contain a trivial bypass bug, CVE-2022-21505.

CVE-2022-21499, patched in May 2022.

See also

• Kernel Modules — object files that contain code to extend the kernel of an operating system.
• Signed kernel module support — allows further hardening of the system by disallowing unsigned kernel modules, or kernel modules signed with the wrong key, to be loaded.
• Extended Verification Module — used to validate security-sensitive extended attributes before allowing operations on the files.
• Integrity Measurement Architecture — is responsible for calculating the hashes of files and programs before they are loaded

External resources

• eBPF in kernel lockdown mode